kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/android
History
Carlos Llamas 98fee5bee9 binder: fix race between mmput() and do_exit() 
commit 9a9ab0d963 upstream.

Task A calls binder_update_page_range() to allocate and insert pages on
a remote address space from Task B. For this, Task A pins the remote mm
via mmget_not_zero() first. This can race with Task B do_exit() and the
final mmput() refcount decrement will come from Task A.

  Task A            | Task B
  ------------------+------------------
  mmget_not_zero()  |
                    |  do_exit()
                    |    exit_mm()
                    |      mmput()
  mmput()           |
    exit_mmap()     |
      remove_vma()  |
        fput()      |

In this case, the work of ____fput() from Task B is queued up in Task A
as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup
work gets executed. However, Task A instead sleep, waiting for a reply
from Task B that never comes (it's dead).

This means the binder_deferred_release() is blocked until an unrelated
binder event forces Task A to go back to userspace. All the associated
death notifications will also be delayed until then.

In order to fix this use mmput_async() that will schedule the work in
the corresponding mm->async_put_work WQ instead of Task A.

Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-01-25 14:52:46 -08:00
..
binder.c binder: use EPOLLERR from eventpoll.h 2024-01-25 14:52:31 -08:00
binder_alloc.c binder: fix race between mmput() and do_exit() 2024-01-25 14:52:46 -08:00
binder_alloc.h binder: fix memory leak in binder_init() 2023-08-16 18:21:59 +02:00
binder_alloc_selftest.c Revert "android: binder: stop saving a pointer to the VMA" 2023-06-05 09:21:24 +02:00
binder_internal.h binder: fix redefinition of seq_file attributes 2022-08-17 14:23:50 +02:00
binder_trace.h binder: add trace at free transaction. 2020-11-11 08:20:44 +01:00
binderfs.c binder: fix redefinition of seq_file attributes 2022-08-17 14:23:50 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00